Security Advisory 2026-0011 (CVE-2026-3084, ZDI-CAN-28910)
|
|
| Summary |
Out-of-bounds write in H.266 video parser when parsing picture partitions |
| Date |
2026-02-25 |
| Affected Versions |
GStreamer gst-plugins-bad >= 1.25.1, < 1.28.1 |
| IDs |
GStreamer-SA-2026-0011
CVE-2026-3084
ZDI-CAN-28910 |
Details
An out-of-bound write in the H.266 video bitstream parser when parsing picture
partitions can cause crashes for certain input files, and could possibly also
allow code execution through heap manipulation.
Impact
It is possible for a malicious third party to trigger a buffer overflow
that can result in a crash of the application and possibly also allow code
execution through stack manipulation.
Solution
The gst-plugins-bad 1.28.1 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.28 (current stable)
Patches
